> Source: [sk120158](https://support.checkpoint.com/results/sk/sk120158)

# sk120158 - "Source address of packet received from 0000.XXXX.XXXX on Name_of_Interface(Name_of_Port) is duplicate of local virtual ip, X.X.X.X" log on Cisco switch connected to Check Point cluster members

| Property | Value |
|----------|-------|
| Solution ID | sk120158 |
| Date Created | 2017-08-25 |
| Last Modified | 2018-11-14 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * "`Source address of packet received from 0000.XXXX.XXXX on Name_of_Interface(Name_of_Port) is duplicate of local virtual ip, X.X.X.X`" log on Cisco switch connected to Check Point cluster members.

  *Example* :  
  `Source address of packet received from 0000.0c07.ac01 on Vlan111(Ethernet1/14) is duplicate of local virtual ip, 192.168.1.1`
* Setting the value of the kernel parameter *fwha_resend_arp_unicast* to 1 on all cluster members per [sk94564](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk94564) does not resolve the issue.

* Traffic capture (tcpdump) on cluster members shows that despite setting *fwha_resend_arp_unicast=1* (per [sk94564](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk94564)), ARP packets are still resent to other cluster members in broadcast mode.

  *Example* :  
  `
  [Expert@hostname:0]# tcpdump -nnei eth2 arp`  
  `
  22:55:10.872330 00:XX:XX:XX:XX:XX > 00:00:0c:07:ac:01, ethertype ARP (0x0806), length 42: arp who-has 192.168.1.1 tell 192.168.1.30`  
  `
  22:55:10.885422 00:00:0c:07:ac:01 > 00:XX:XX:XX:XX:XX, ethertype ARP (0x0806), length 60: arp reply 192.168.1.1 is-at 00:00:0c:07:ac:01`  
  `
  22:55:10.885446 00:XX:XX:XX:XX:XX > `***ff:ff:ff:ff:ff:ff*** `, ethertype ARP (0x0806), length 42: arp reply 192.168.1.1 is-at 00:00:0c:07:ac:01`  
  `
  22:55:10.885452 00:XX:XX:XX:XX:XX > `***ff:ff:ff:ff:ff:ff***`, ethertype ARP (0x0806), length 42: arp reply 192.168.1.1 is-at 00:00:0c:07:ac:01
  `
* Output of "`arp -a`" command on cluster members does not show ARP entries for the peer cluster members.

## Cause

Cluster members do not "know" the MAC addresses of the peer cluster members, so that ARP packets could be resent to the peer cluster members in unicast mode.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content